P7 DarkSword iOS exploit kit Targets Crypto Wallets and Enables Remote Commands
On Oct 9 2026, iVerify released a report detailing a new variant of the DarkSword iOS exploit kit, dubbed P7 DarkSword. The variant expands the original kit’s capabilities by adding on-device keychain and crypto-wallet theft and establishing two-way command-and-control (C2) communication with the attacker’s infrastructure.
Attack Path and Technical Details
P7 DarkSword follows the classic DarkSword chain: it exploits a set of iOS vulnerabilities to escape the browser sandbox, escalates to kernel privileges, and injects its payload into SpringBoard—the process that manages app launches and the home screen. The injection point allows the attacker to persist on the device and execute arbitrary code with elevated privileges.
The new variant reduces its on-device footprint compared to earlier DarkSword releases. It removes debug logging and streamlines the payload to minimize detection. Once inside SpringBoard, the kit reads the device’s keychain, extracting credentials for crypto wallets and other sensitive applications. The stolen data is then transmitted back to the attacker via a lightweight, encrypted channel.
In addition to data exfiltration, P7 DarkSword implements a two-way C2 protocol. The attacker can issue remote commands to the compromised device, enabling dynamic payload updates, persistence mechanisms, or additional data collection. This shift from a single-shot exploit to a persistent foothold increases the operational value of the kit for financially motivated actors.
Known Campaigns and Targeted Regions
Since its emergence in November 2025, DarkSword has been deployed in campaigns across Saudi Arabia, Turkey, Malaysia, and Ukraine. Recent activity includes a Turkish commercial surveillance vendor, PARS Defense, using a fake Snapchat-themed website to deliver the kit, and a Russia-aligned threat actor, Star Blizzard (aka COLDRIVER), leveraging fake invitation lures. In August 2026, an unnamed Chinese-speaking actor mounted a campaign that combined the kit with an Apple ID decoy sign-in page, targeting iOS devices in multiple regions.
Exposure and Evidence
Defenders should look for the following indicators:
- Unusual SpringBoard activity or injection attempts in system logs.
- Network traffic to known DarkSword C2 endpoints, especially encrypted channels originating from the device.
- Keychain access events that coincide with the launch of unknown processes.
Logs from the device’s Console and Device Console can reveal the injection point and the subsequent keychain reads. Network forensics should focus on outbound traffic to the attacker’s infrastructure, which typically uses HTTPS over non-standard ports to avoid detection.
Mitigation Guidance
- Patch iOS: The latest public patch, iOS 18.7, addresses the vulnerabilities leveraged by DarkSword. Devices running iOS 18.4-18.6 should upgrade immediately.
- Restrict App Sandbox: Enforce strict App Sandbox policies and monitor for processes that gain elevated privileges.
- Keychain Access Controls: Implement Keychain Access Groups and enforce least-privilege principles for crypto wallet applications.
- Network Monitoring: Deploy IDS/IPS rules that flag outbound HTTPS traffic from the device to known DarkSword C2 domains.
- Endpoint Detection: Use EDR solutions that can detect SpringBoard injection attempts and anomalous keychain reads.
Second-Order Consequences
The addition of remote command capability means that once a device is compromised, the attacker can modify the payload on the fly, potentially bypassing future patches. This persistence model raises the risk of long-term data exfiltration, especially from crypto wallets that may contain large balances. Organizations that rely on iOS devices for financial transactions should prioritize patching and monitoring.
What to Watch Next
The iVerify team noted attempts to update the framework for iOS 26.x, suggesting the kit is being adapted for future iOS releases. Defenders should stay alert for new variants that may target newer operating systems.
Conclusion
P7 DarkSword represents a measurable evolution in the DarkSword family, adding keychain theft and remote command capabilities while maintaining a low on-device footprint. Immediate patching of iOS 18.7 and vigilant monitoring for SpringBoard injection and keychain access are the primary defensive measures. Continuous analysis of network traffic for C2 activity will help detect and contain ongoing campaigns.
Related coverage
- Microsoft Twitter Account Hijacked for Crypto Scam Featuring Clippy
- How SMB Cybersecurity Complexity Threatens Advanced Protection Goals
- Threat Actors Exploit AI Chatbot Security Vulnerabilities for Mass Disinformation and Phishing Campaigns